Government agencies issue vendor questionnaire on post-quantum cryptography readiness

On November 4, the NSA, CISA, and Australia's ASD's ACSC published a 19-page guide of questions for buyers to ask software and hardware vendors about their post-quantum cryptography readiness. The document is a joint update of an earlier Australian version released in July. It follows NIST's final transition plan, which deprecates RSA and elliptic-curve cryptography after 2030 and disallows them after 2035. The guidance centers on a cryptographic bill of materials that inventories every algorithm, library, and configuration a product relies on, including those inherited from third parties. Buyers are encouraged to ask whether vendors can provide such an inventory and when post-quantum-ready releases will ship in time for deployment before 2030.